vdequator WordPress theme: Cross-Site Request Forgery (CSRF)

Summary

The vdequator WordPress theme by webriti is affected by a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.2.7. An attacker can make a logged-in user, such as a site administrator, perform actions they did not intend, for example by luring them to a malicious web page. The attack requires that the victim visits the attacker's page while logged in, and no prior login by the attacker is needed.

Affected

• webriti vdequator WordPress theme, versions up to and including 1.2.7 (CVE record: 0 to <= 1.2.7; description: n/a through 1.2.7, so the lower bound is unclear)
• The parent theme BusiProf is not known to be affected.

Fixed in

Unknown. No fixed version has been confirmed; Patchstack lists no official patch.

Workaround

• No vendor mitigation has been found.
• Deactivating the theme does not remove the risk unless a virtual patch is in place.
• Limit administrator logins and require administrators to log out after each session.

Exploitation

• CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); user interaction is required.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• An aggregator reports no known exploitation (not a primary source). No public proof of concept has been found, but the CVE was published only recently.

Our recommendation

• Identify all sites that use vdequator, including deactivated copies, and record the installed version.
• Check the Patchstack advisory and the webriti website for a fixed release and update if one is available.
• If no fix exists, replace the theme with a maintained alternative and remove the unused copy.
• Until then, limit administrator logins, require logout after use, and check the NVD entry, which is currently Deferred.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record (Patchstack CNA) www.cve.org
• Patchstack advisory patchstack.com
• Threat intel mirror cve.threatint.com
• Aggregator: exploitation and affected table radar.offseq.com
• WordPress.org theme page wordpress.org
• webriti free WordPress themes webriti.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:24.